PT-2025-35161

Name of the Vulnerable Software and Affected Versions CGI::Simple versions prior to 1.282 Description CGI::Simple contains a HTTP response splitting flaw that allows HTTP response header injection. This can be exploited to perform reflected cross-site scripting XSS, open redirect, cache poisoning...

CVE-2025-4302

The Stop User Enumeration WordPress plugin before version 1.7.3 blocks REST API /wp-json/wp/v2/users/ requests for non-authorized users. However, this can be bypassed by URL-encoding the API path...

WordPress plugin “Stop User Enumeration” has a security vulnerability

WordPress Stop User Enumeration plugin is a security plugin for WordPress, mainly used to detect and prevent hackers from scanning website usernames user enumeration attack to get the login name, which is the pre-detection behavior of brute force password cracking attack. A security vulnerability...

PT-2025-23052 · Apache · Apache Inlong

Name of the Vulnerable Software and Affected Versions: Apache InLong versions 1.13.0 through 2.1.0 Description: The issue is related to the deserialization of untrusted data in Apache InLong, which can lead to the bypass of JDBC URL encoding and backspace. This can potentially cause security...

CVE-2024-48917

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported CVE-2024-47873, the regexes from the findCharSet method, which is used for determining the current...

CVE-2024-36498 Stored cross site scripting

Due to missing input sanitization, an attacker can perform cross-site-scripting attacks and run arbitrary Javascript in the browser of other users. The "Edit Disclaimer Text" function of the configuration menu is vulnerable to stored XSS. Only the users Poweruser and Admin can use this function...

CVE-2024-48917

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The "XmlScanner" class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported "CVE-2024-47873", the regexes from the "findCharSet" method, which is used for determining the...

CVE-2024-48917 XXE in PHPSpreadsheet's XLSX reader

PhpSpreadsheet is a PHP library for reading and writing spreadsheet files. The XmlScanner class has a scan method which should prevent XXE attacks. However, in a bypass of the previously reported CVE-2024-47873, the regexes from the findCharSet method, which is used for determining the current...

CVE-2024-23983: Improper Input Validation

Improper handling of canonical URL-encoding may lead to bypass not properly constrained by request rules...

DEBIAN-CVE-2019-9852

LibreOffice has a feature where documents can specify that pre-installed macros can be executed on various script events such as mouse-over, document-open etc. Access is intended to be restricted to scripts under the share/Scripts/python, user/Scripts/python sub-directories of the LibreOffice...

PT-2019-3160 · Document Foundation +5 · Libreoffice +5

Name of the Vulnerable Software and Affected Versions: Document Foundation LibreOffice versions prior to 6.2.6 Description: The issue is related to the handling of URLs in LibreOffice, specifically with the LibreLogo module. It allows a remote attacker to execute arbitrary code on the target syst...

Information Exposure

Overview harp is a zero-configuration web server with built in pre-processing. Affected versions of this package are vulnerable to Information Exposure. The documentation explicitly mentions that files or directories with names that start with an underscore are ignored by the server and are not...

CVE-2016-10367

In Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding...

PT-2017-7883

Name of the Vulnerable Software and Affected Versions Opsview Monitor Pro versions prior to 5.1.0.162300841 Opsview Monitor Pro versions prior to 5.0.2.27475 Opsview Monitor Pro versions prior to 4.6.4.162391051 Opsview Monitor Pro version 4.5.x without a certain 2016 security patch Description A...

CVE-2016-10367: Improper Limitation of a Pathname to a Restricted Directory

In Opsview Monitor Pro Prior to 5.1.0.162300841, prior to 5.0.2.27475, prior to 4.6.4.162391051, and 4.5.x without a certain 2016 security patch, an unauthenticated Directory Traversal vulnerability can be exploited by issuing a specially crafted HTTP GET request utilizing a simple URL encoding...

CVE-2004-0051: Undefined Security Weakness

Multiple content security gateway and antivirus products allow remote attackers to bypass content restrictions via MIME messages that use non-standard but frequently supported Content-Transfer-Encoding values such as 1 uuencode, 2 mac-binhex40, and 3 yenc, which may be interpreted differently by...

Microsoft Windows Script Host 5.1/5.5 - 'GetObject()' File Disclosure

source: https://www.securityfocus.com/bid/1718/info It is possible for an outside attacker to view known files on a remote system if the target user visits a website or opens an email containing a specially formed script containing the JScript function 'GetObject' and the ActiveX object 'htmlfile...